A duplicate-detection data-safety overhaul, safer automatic metadata fetching, and a comic-reader security fix.
docker pull ghcr.io/new-usemame/calibre-web-nextgen:v4.0.160
(Or :latest. Already on :dev? You have all of this.)
Security
- Comic (CBR/CBZ) reader. The reader used to run your saved page bookmark through JavaScript's
eval(), so a bookmark value containing code — which any logged-in account could store for a comic — would execute when the reader page opened. Bookmarks are now read strictly as a page number.
Duplicate detection — your data is now safe through a merge
- Merging duplicates keeps your highlights, notes, reading progress, and shelves. Previously only the book files moved to the kept copy; annotations, read status, Kobo position and shelf membership on the removed copy silently disappeared. All of it now follows the kept book, whichever resolve strategy you use.
- Merging can no longer overwrite a kept book's files. If a file with the target's name was already on disk, the merge used to copy over it; it now refuses with a clear error and leaves every file untouched, cleaning up after a partial failure instead of leaving stray files behind.
- Dismissed duplicate groups stay dismissed across new ingests and metadata edits — adding another copy or editing a title no longer makes a dismissed group reappear.
- Hidden books stay out of your duplicate scan (they used to reappear there and could be swept into auto-resolution).
- Copies whose titles differ only in accents or spacing now match — a decomposed-accent "Café" and a typed "Café", or "The Book" with a double space, are recognized as duplicates. Existing dismissals carry over automatically.
- The experimental SQL scan mode now returns the same results as the default mode instead of its own divergent (sometimes wrong) grouping.
Automatic metadata fetch — no more clobbering good data
- Auto-fetch (admin option, off by default) no longer overwrites a correct author, ISBN, series, date, or rating with a wrong match's. It now prefers the edition whose ISBN matches your book, and "smart application" mode only fills what's missing.
- Cover download actually works now — the "update cover" option existed but did nothing. Covers download through the same safe path as the manual editor and, in smart mode, only fill a missing cover. (#404, confirmed by @beanscg)
- Downloading a cover by URL no longer destroys the existing cover when the server returns a redirect stub or an error page with an image content-type.
Reading & shelves
- KOReader completions mark a book read even with a custom "read" column. If your admin set a Calibre custom column as the read marker, finishing in KOReader left the book-page checkmark empty — it now sets the custom column too (and never silently un-reads).
- Metadata search dialog lists providers in your configured order, not alphabetically, and ranks results the same way.
- Adding several books at once to a Kobo-synced shelf now syncs them to Hardcover, like single adds always did — as a background task, so a long series doesn't hold the page open.
- Shelf reorder: the giant white sort icon is gone and covers stay thumbnail-sized even behind certain reverse proxies. (#320, reported with screenshots by @SpookyUSAF)
- Deleting a book updates the library first and removes files last, so a failure partway can no longer leave a broken "ghost" entry.
Found something still off? Open an issue at https://github.com/new-usemame/Calibre-Web-NextGen/issues — we respond.